Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| decompress | npm | <= 4.2.1 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the decompress package's handling of hardlink entries during archive extraction. The analysis began by examining the provided GitHub issue, which confirmed the vulnerability but indicated that no official patch had been released. To verify this, I inspected the kevva/decompress repository. There were no commits associated with the issue, and no pull requests addressing it. Comparing the latest tag v4.2.1 with the master branch revealed no new commits, suggesting the repository has not been updated with a fix. By fetching the content of index.js from the master branch, I confirmed that the vulnerable code is still present. The core of the vulnerability is in the extractFile function. This function iterates through the files extracted from an archive. When a file is of type 'link', the code directly passes the linkname from the archive to the fs.link function without any sanitization or validation. This allows an attacker to create a hardlink to any file on the filesystem by crafting a malicious archive, leading to potential information disclosure or file corruption. Therefore, the extractFile function is the identifiable vulnerable function that would appear in a runtime profile during exploitation.
extractFileindex.js